This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Yemeni threat actors attempted to use Anthropic's Claude to develop guidance, control, and navigation software for ballistic missiles and guided rockets.
Anthropic reported that a northern Yemen-based weapons cell, designated GTG-87001, used Claude Code across three weapons programs to develop guidance, navigation, and control software. The actors reportedly test-fired a guided rocket that appeared to fail, then returned to Claude for failure analysis. Anthropic said it banned associated accounts and shared threat intelligence with partners.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to develop cyber weapons (e.g., by coding cheaper, more effective malware), develop new or enhance existing weapons (e.g., Lethal Autonomous Weapons or chemical, biological, radiological, nuclear, and high-yield explosives), or use weapons to cause mass harm.
Also classified as
Anthropic's safety filters and safeguards failed to block all malicious requests, allowing the actors to successfully generate code for weapons development.
The incident involved threat actors using an AI system to develop guidance and control software for ballistic missiles and guided rockets, which are weapons capable of causing mass harm.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The risk and subsequent actions were caused by human threat actors intentionally using the deployed AI model to develop guidance software for weapons.
Yemeni threat actors, likely Houthi rebels, attempted to use Anthropic's Claude to develop guidance, control, and navigation software for ballistic missiles and guided rockets. While the test-fire failed and accounts were banned, the incident highlights a substantial national security concern regarding the proliferation of dual-use AI to assist in weapon development.
The report describes the threat actors using Claude as an assistant in place of human software engineers to write control software, tune settings, and run a firmware pipeline under human direction.
Limited Risk: The system involved is Claude, which is a general-purpose chatbot, though the malicious application of it by users targeted high-risk military domains.
The threat actors primarily used Claude to write guidance, navigation, and control software, as well as integrate autopilot systems and run firmware pipelines.
The report from Anthropic provides clear, first-hand threat intelligence details about how the model was used, the specific technical tasks performed by the actors, and the limitations of the safeguards.
None, the malicious intent and technical application of the AI system are clearly documented.
Technology
Incomplete Safeguards
Claude blocked many requests, but not all of them, allowing some to pass.
Vulnerability to Evasion
The model was vulnerable to evasion tactics like session splitting.
Data Inputs
Obfuscated Prompt Inputs
Actors hid their goals and the products the software was meant for.
Fragmented Input Sessions
Work was split across multiple sessions to hide the overall intent.
Human Factors
Malicious Intent of Threat Actors
Yemeni threat actors actively sought to use AI to build missile software.
Technical Sophistication
Actors possessed engineering skills to integrate open-source autopilot systems.
Process and Methods
Lack of Multi-Session Context
Safety systems failed to link context across separate, fragmented sessions.
Post-Incident Analysis Gap
Actors used the AI to troubleshoot failed physical tests in real time.
Management
Delayed Account Sanctions
Accounts were banned only after sustained weapons development work occurred.
Regulatory Environment
Lack of Dual-Use Controls
Absence of strict global regulations preventing access to dual-use AI tools.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
No population impact data reported.
